[{"data":1,"prerenderedAt":187},["ShallowReactive",2],{"content:zh:guides\u002Fmd5-vs-sha256":3},{"id":4,"title":5,"body":6,"description":169,"extension":170,"faq":171,"kind":178,"locale":179,"meta":180,"navigation":181,"path":182,"seo":183,"seoTitle":184,"stem":185,"__hash__":186},"pages\u002Fzh\u002Fguides\u002Fmd5-vs-sha256.md","MD5 与 SHA-256：长度、兼容性与信任边界",{"type":7,"value":8,"toc":159},"minimark",[9,14,18,83,86,89,92,95,98,101,104,107,110,113,116,151],[10,11,13],"h2",{"id":12},"先遵循协议不是先挑最长结果","先遵循协议，不是先挑最长结果",[15,16,17],"p",{},"对方给的是 MD5 参考值，就计算 MD5，不能拿 SHA-256 与它比较。如果自己设计新的通用指纹流程，SHA-256 通常比 MD5 更合适，但普通摘要仍然不是身份认证机制。算法名称必须跟着结果一起保留。",[19,20,21,37],"table",{},[22,23,24],"thead",{},[25,26,27,31,34],"tr",{},[28,29,30],"th",{},"对比项目",[28,32,33],{},"MD5",[28,35,36],{},"SHA-256",[38,39,40,52,63,73],"tbody",{},[25,41,42,46,49],{},[43,44,45],"td",{},"摘要长度",[43,47,48],{},"128 位",[43,50,51],{},"256 位",[25,53,54,57,60],{},[43,55,56],{},"完整十六进制",[43,58,59],{},"32 个字符",[43,61,62],{},"64 个字符",[25,64,65,68,71],{},[43,66,67],{},"普通摘要包含密钥吗",[43,69,70],{},"不包含",[43,72,70],{},[25,74,75,78,81],{},[43,76,77],{},"能否作为可逆加密使用",[43,79,80],{},"不能",[43,82,80],{},[10,84,85],{"id":85},"一致究竟说明什么",[15,87,88],{},"两个相同的计算结果，说明在当前输入和计算规则下数值一致，不能说明是谁提供了文件。如果文件和参考摘要都来自同一条已被控制的渠道，攻击者可以把二者一起替换。需要发布者真实性时，应使用可信渠道及对应的数字签名验证流程。",[15,90,91],{},"MD5 的碰撞弱点在对手有意构造不同内容时尤其重要。“平时检查复制文件够用”不是把 MD5 引入新签名格式的理由。不过，为历史接口复现其既定 MD5，仍然可以是明确的兼容性需求。",[10,93,94],{"id":94},"先比较相同字节",[15,96,97],{},"abc、abc 加换行、带 UTF-8 字节顺序标记的文件，是三种不同输入。压缩包的解压目录，也不是压缩包原始字节。重命名通常不影响摘要，重新构建或重新压缩却可能改变元数据和结果。",[15,99,100],{},"首页单条文本结果同时显示 MD5、SHA-256 和 SHA-512，标签用于区分算法，而应按标签选择需要核对的结果。核对文件时请选择发布者指定算法，并比较完整值，避免只看前几个字符。",[10,102,103],{"id":103},"消息认证与密码是不同任务",[15,105,106],{},"共享密钥认证应使用 HMAC 等定义明确的构造，不是临时把密钥与消息拼接。密码存储需要专用的密码哈希设计与恰当参数，不是把 MD5 换成长一些的快速摘要就算完成。校验工具也不是杀毒软件、签名验证器或恢复服务。",[10,108,109],{"id":109},"交付可用的核对信息",[15,111,112],{},"记录算法、完整结果和文件版本；可信参考值应与尚未验证的文件分开管理。本地导出可以保留标识和计算值，不默认包含私密原文或密钥。发生不匹配时，先排查参考来源及文件版本，再决定是否重新下载或联系发布者。",[10,114,115],{"id":115},"相关工具与指南",[117,118,119,127,133,139,145],"ul",{},[120,121,122],"li",{},[123,124,126],"a",{"href":125},"\u002Fzh","MD5 哈希生成器",[120,128,129],{},[123,130,132],{"href":131},"\u002Fzh\u002Ffile-md5","文件校验工具",[120,134,135],{},[123,136,138],{"href":137},"\u002Fzh\u002Fguides\u002Fmd5-checksum-windows","Windows 文件 MD5 校验：PowerShell 操作与差异排查",[120,140,141],{},[123,142,144],{"href":143},"\u002Fzh\u002Fguides\u002Fmd5sum-linux","Linux md5sum 使用指南：文件、清单与换行",[120,146,147],{},[123,148,150],{"href":149},"\u002Fzh\u002Fguides\u002Fwhat-is-md5","什么是 MD5：原始字节、128 位摘要与常见误解",[15,152,153],{},[123,154,158],{"href":155,"rel":156},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6151.html",[157],"nofollow","RFC 6151",{"title":160,"searchDepth":161,"depth":161,"links":162},"",2,[163,164,165,166,167,168],{"id":12,"depth":161,"text":13},{"id":85,"depth":161,"text":85},{"id":94,"depth":161,"text":94},{"id":103,"depth":161,"text":103},{"id":109,"depth":161,"text":109},{"id":115,"depth":161,"text":115},"比较两种摘要的实际用途，理解为什么校验匹配不等于文件安全或发布者可信。","md",[172,175],{"question":173,"answer":174},"SHA-256 结果可以和 MD5 参考值比较吗？","不可以。MD5 是 32 个十六进制字符，SHA-256 是 64 个。应使用参考值指定的算法重新计算，不能通过截断或补齐把它们互相转换。",{"question":176,"answer":177},"改用 SHA-256 就能验证发布者身份吗？","不能。普通摘要没有密钥或数字签名。应从可信渠道取得参考值，需要验证来源时遵循发布者的签名验证流程。","guide","zh",{},true,"\u002Fzh\u002Fguides\u002Fmd5-vs-sha256",{"title":5,"description":169},"MD5 与 SHA-256：长度、兼容性与信任边界 — md5hash.net","zh\u002Fguides\u002Fmd5-vs-sha256","EGgzrNo4XgVZ0xy_zeFQ7RcsRIwC-B8cz311pdDNdic",1792048884804]